From 17cd7397590b479f25fa27af51b5b8c39124dc63 Mon Sep 17 00:00:00 2001 From: DevomB Date: Sat, 19 Sep 2026 23:14:23 -0700 Subject: [PATCH 1/2] The microcode and the clock are ticked, each with what proves it and what does not Both were built and have passed acceptance; the roadmap still showed them open. The microcode entry says what a virtual machine cannot prove: the early loader does nothing under a hypervisor, so the load itself waits for a physical boot. The clock entry names the run its five guest checks passed in. --- docs/roadmap.md | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 6d189c6..3a1b6e0 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -253,16 +253,19 @@ passes, not when its code is written. each machine lacked becomes a line in `boot.fragment` or `firmware.list`, and the machines become the first rows of a hardware list in the README. -- [ ] **CPU microcode.** Nothing loads it. With no initramfs it is built into - the signed kernel from the pinned firmware release (AMD) and Intel's - microcode release, and the boot smoke test reports the revision it - found and the one it loaded. -- [ ] **A clock that is right.** The image has no time synchronisation, and - certificate validation and update freshness both assume the time. - Zone 0 has no network, so the net zone asks (NTS or NTP) and zone 0 - decides: the broker carries the answer, zone 0 refuses one that moves - the clock backwards past the last release's date or forwards by more - than a bound without consent. +- [x] **CPU microcode.** With no initramfs it is built into the signed kernel + from Intel's microcode release and AMD's containers in the pinned + firmware release; stage 05 refuses a kernel that does not contain the + blobs, and the boot report prints the revision and what the early + loader said. Under a hypervisor the loader does nothing, so the load + itself is proven only when a physical machine boots. +- [x] **A clock that is right.** Zone 0 has no network, so the net zone + measures the offset with an SNTP query and zone 0 decides: never + before the build date, small corrections applied, anything past a + bound only with the person's consent, one claim an hour. A boot + service sets a clock that reads before the build date to the build + date. Five guest checks prove it on the installed system (acceptance + on 55e1652, 2026-09-20). NTS is not used. ### It can be trusted by someone who did not build it From ff773a29c27938eb1da362c17876c3e66bed61e0 Mon Sep 17 00:00:00 2001 From: DevomB Date: Sat, 19 Sep 2026 23:21:06 -0700 Subject: [PATCH 2/2] The clock's roadmap entry says ten minutes, and names the rule against small steps The first wording said one claim an hour. The interval is ten minutes (CLAIM_INTERVAL_SECS = 600); the hour is the bound, and it applies to a run of small corrections together, which is what stops a hostile net zone walking the clock. Corrected by the clock's author in review, and taken as written. --- docs/roadmap.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 3a1b6e0..4b5885a 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -261,11 +261,13 @@ passes, not when its code is written. itself is proven only when a physical machine boots. - [x] **A clock that is right.** Zone 0 has no network, so the net zone measures the offset with an SNTP query and zone 0 decides: never - before the build date, small corrections applied, anything past a - bound only with the person's consent, one claim an hour. A boot - service sets a clock that reads before the build date to the build - date. Five guest checks prove it on the installed system (acceptance - on 55e1652, 2026-09-20). NTS is not used. + before the build date; a correction of up to an hour is applied, and + so is a run of them until together they reach an hour; past that only + with the person's consent, asked in the trusted chrome with both + times shown; one claim every ten minutes. A boot service sets a + clock that reads before the build date to the build date. Five guest + checks prove it on the installed system (acceptance on 55e1652, + 2026-09-20). NTS is not used. ### It can be trusted by someone who did not build it